renovate[bot]
commented
3 months ago ℹ Artifact update notice
File name: go.mod
In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):
- 2 additional dependencies were updated
Details:
| Package | Change |
|---|---|
github.com/json-iterator/go |
v1.1.10 -> v1.1.12 |
github.com/stretchr/testify |
v1.6.1 -> v1.8.3 |
This PR contains the following updates:
v1.6.3->v1.9.1GitHub Vulnerability Alerts
CVE-2020-28483
When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7.
CVE-2023-26125
Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.
Note: Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
CVE-2023-29401
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat";x=.txt" will be sent as a file named "setup.bat".
If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.
Release Notes
gin-gonic/gin (github.com/gin-gonic/gin)
### [`v1.9.1`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v191) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.9.0...v1.9.1) ##### BUG FIXES - fix Request.Context() checks [#3512](https://redirect.github.com/gin-gonic/gin/pull/3512) ##### SECURITY - fix lack of escaping of filename in Content-Disposition [#3556](https://redirect.github.com/gin-gonic/gin/pull/3556) ##### ENHANCEMENTS - refactor: use bytes.ReplaceAll directly [#3455](https://redirect.github.com/gin-gonic/gin/pull/3455) - convert strings and slices using the officially recommended way [#3344](https://redirect.github.com/gin-gonic/gin/pull/3344) - improve render code coverage [#3525](https://redirect.github.com/gin-gonic/gin/pull/3525) ##### DOCS - docs: changed documentation link for trusted proxies [#3575](https://redirect.github.com/gin-gonic/gin/pull/3575) - chore: improve linting, testing, and GitHub Actions setup [#3583](https://redirect.github.com/gin-gonic/gin/pull/3583) ### [`v1.9.0`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v190) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.8.2...v1.9.0) ##### BREAK CHANGES - Stop useless panicking in context and render [#2150](https://redirect.github.com/gin-gonic/gin/pull/2150) ##### BUG FIXES - fix(router): tree bug where loop index is not decremented. [#3460](https://redirect.github.com/gin-gonic/gin/pull/3460) - fix(context): panic on NegotiateFormat - index out of range [#3397](https://redirect.github.com/gin-gonic/gin/pull/3397) - Add escape logic for header [#3500](https://redirect.github.com/gin-gonic/gin/pull/3500) and [#3503](https://redirect.github.com/gin-gonic/gin/pull/3503) ##### SECURITY - Fix the GO-2022-0969 and GO-2022-0288 vulnerabilities [#3333](https://redirect.github.com/gin-gonic/gin/pull/3333) - fix(security): vulnerability GO-2023-1571 [#3505](https://redirect.github.com/gin-gonic/gin/pull/3505) ##### ENHANCEMENTS - feat: add sonic json support [#3184](https://redirect.github.com/gin-gonic/gin/pull/3184) - chore(file): Creates a directory named path [#3316](https://redirect.github.com/gin-gonic/gin/pull/3316) - fix: modify interface check way [#3327](https://redirect.github.com/gin-gonic/gin/pull/3327) - remove deprecated of package io/ioutil [#3395](https://redirect.github.com/gin-gonic/gin/pull/3395) - refactor: avoid calling strings.ToLower twice [#3343](https://redirect.github.com/gin-gonic/gin/pull/3433) - console logger HTTP status code bug fixed [#3453](https://redirect.github.com/gin-gonic/gin/pull/3453) - chore(yaml): upgrade dependency to v3 version [#3456](https://redirect.github.com/gin-gonic/gin/pull/3456) - chore(router): match method added to routergroup for multiple HTTP methods supporting [#3464](https://redirect.github.com/gin-gonic/gin/pull/3464) - chore(http): add support for go1.20 http.rwUnwrapper to gin.responseWriter [#3489](https://redirect.github.com/gin-gonic/gin/pull/3489) ##### DOCS - docs: update markdown format [#3260](https://redirect.github.com/gin-gonic/gin/pull/3260) - docs(readme): Add the TOML rendering example [#3400](https://redirect.github.com/gin-gonic/gin/pull/3400) - docs(readme): move more example to docs/doc.md [#3449](https://redirect.github.com/gin-gonic/gin/pull/3449) - docs: update markdown format [#3446](https://redirect.github.com/gin-gonic/gin/pull/3446) ### [`v1.8.2`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v182) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.8.1...v1.8.2) ##### BUG FIXES - fix(route): redirectSlash bug (https://redirect.github.com/gin-gonic/gin/pull/3227)ic/gin/pull/3227\))) - fix(engine): missing route params for CreateTestContext (https://redirect.github.com/gin-gonic/gin/pull/2778)ic/gin/pull/2778\))) (https://redirect.github.com/gin-gonic/gin/pull/2803)ic/gin/pull/2803\))) ##### SECURITY - Fix the GO-2022-1144 vulnerability (https://redirect.github.com/gin-gonic/gin/pull/3432)ic/gin/pull/3432\))) ### [`v1.8.1`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v181) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.8.0...v1.8.1) ##### ENHANCEMENTS - feat(context): add ContextWithFallback feature flag [#3172](https://redirect.github.com/gin-gonic/gin/pull/3172) ### [`v1.8.0`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v180) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.7...v1.8.0) ##### BREAK CHANGES - TrustedProxies: Add default IPv6 support and refactor [#2967](https://redirect.github.com/gin-gonic/gin/pull/2967). Please replace `RemoteIP() (net.IP, bool)` with `RemoteIP() net.IP` - gin.Context with fallback value from gin.Context.Request.Context() [#2751](https://redirect.github.com/gin-gonic/gin/pull/2751) ##### BUG FIXES - Fixed SetOutput() panics on go 1.17 [#2861](https://redirect.github.com/gin-gonic/gin/pull/2861) - Fix: wrong when wildcard follows named param [#2983](https://redirect.github.com/gin-gonic/gin/pull/2983) - Fix: missing sameSite when do context.reset() [#3123](https://redirect.github.com/gin-gonic/gin/pull/3123) ##### ENHANCEMENTS - Use Header() instead of deprecated HeaderMap [#2694](https://redirect.github.com/gin-gonic/gin/pull/2694) - RouterGroup.Handle regular match optimization of http method [#2685](https://redirect.github.com/gin-gonic/gin/pull/2685) - Add support go-json, another drop-in json replacement [#2680](https://redirect.github.com/gin-gonic/gin/pull/2680) - Use errors.New to replace fmt.Errorf will much better [#2707](https://redirect.github.com/gin-gonic/gin/pull/2707) - Use Duration.Truncate for truncating precision [#2711](https://redirect.github.com/gin-gonic/gin/pull/2711) - Get client IP when using Cloudflare [#2723](https://redirect.github.com/gin-gonic/gin/pull/2723) - Optimize code adjust [#2700](https://redirect.github.com/gin-gonic/gin/pull/2700/files) - Optimize code and reduce code cyclomatic complexity [#2737](https://redirect.github.com/gin-gonic/gin/pull/2737) - Improve sliceValidateError.Error performance [#2765](https://redirect.github.com/gin-gonic/gin/pull/2765) - Support custom struct tag [#2720](https://redirect.github.com/gin-gonic/gin/pull/2720) - Improve router group tests [#2787](https://redirect.github.com/gin-gonic/gin/pull/2787) - Fallback Context.Deadline() Context.Done() Context.Err() to Context.Request.Context() [#2769](https://redirect.github.com/gin-gonic/gin/pull/2769) - Some codes optimize [#2830](https://redirect.github.com/gin-gonic/gin/pull/2830) [#2834](https://redirect.github.com/gin-gonic/gin/pull/2834) [#2838](https://redirect.github.com/gin-gonic/gin/pull/2838) [#2837](https://redirect.github.com/gin-gonic/gin/pull/2837) [#2788](https://redirect.github.com/gin-gonic/gin/pull/2788) [#2848](https://redirect.github.com/gin-gonic/gin/pull/2848) [#2851](https://redirect.github.com/gin-gonic/gin/pull/2851) [#2701](https://redirect.github.com/gin-gonic/gin/pull/2701) - TrustedProxies: Add default IPv6 support and refactor [#2967](https://redirect.github.com/gin-gonic/gin/pull/2967) - Test(route): expose performRequest func [#3012](https://redirect.github.com/gin-gonic/gin/pull/3012) - Support h2c with prior knowledge [#1398](https://redirect.github.com/gin-gonic/gin/pull/1398) - Feat attachment filename support utf8 [#3071](https://redirect.github.com/gin-gonic/gin/pull/3071) - Feat: add StaticFileFS [#2749](https://redirect.github.com/gin-gonic/gin/pull/2749) - Feat(context): return GIN Context from Value method [#2825](https://redirect.github.com/gin-gonic/gin/pull/2825) - Feat: automatically SetMode to TestMode when run go test [#3139](https://redirect.github.com/gin-gonic/gin/pull/3139) - Add TOML bining for gin [#3081](https://redirect.github.com/gin-gonic/gin/pull/3081) - IPv6 add default trusted proxies [#3033](https://redirect.github.com/gin-gonic/gin/pull/3033) ##### DOCS - Add note about nomsgpack tag to the readme [#2703](https://redirect.github.com/gin-gonic/gin/pull/2703) ### [`v1.7.7`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v177) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.6...v1.7.7) ##### BUG FIXES - Fixed X-Forwarded-For unsafe handling of CVE-2020-28483 [#2844](https://redirect.github.com/gin-gonic/gin/pull/2844), closed issue [#2862](https://redirect.github.com/gin-gonic/gin/issues/2862). - Tree: updated the code logic for `latestNode` [#2897](https://redirect.github.com/gin-gonic/gin/pull/2897), closed issue [#2894](https://redirect.github.com/gin-gonic/gin/issues/2894) [#2878](https://redirect.github.com/gin-gonic/gin/issues/2878). - Tree: fixed the misplacement of adding slashes [#2847](https://redirect.github.com/gin-gonic/gin/pull/2847), closed issue [#2843](https://redirect.github.com/gin-gonic/gin/issues/2843). - Tree: fixed tsr with mixed static and wildcard paths [#2924](https://redirect.github.com/gin-gonic/gin/pull/2924), closed issue [#2918](https://redirect.github.com/gin-gonic/gin/issues/2918). ##### ENHANCEMENTS - TrustedProxies: make it backward-compatible [#2887](https://redirect.github.com/gin-gonic/gin/pull/2887), closed issue [#2819](https://redirect.github.com/gin-gonic/gin/issues/2819). - TrustedPlatform: provide custom options for another CDN services [#2906](https://redirect.github.com/gin-gonic/gin/pull/2906). ##### DOCS - NoMethod: added usage annotation ([#2832](https://redirect.github.com/gin-gonic/gin/pull/2832#issuecomment-929954463)). ### [`v1.7.6`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v176) ##### BUG FIXES - bump new release to fix v1.7.5 release error by using v1.7.4 codes. ### [`v1.7.4`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v174) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.3...v1.7.4) ##### BUG FIXES - bump new release to fix checksum mismatch ### [`v1.7.3`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v173) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.2...v1.7.3) ##### BUG FIXES - fix level 1 router match [#2767](https://redirect.github.com/gin-gonic/gin/issues/2767), [#2796](https://redirect.github.com/gin-gonic/gin/issues/2796) ### [`v1.7.2`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v172) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.1...v1.7.2) ##### BUG FIXES - Fix conflict between param and exact path [#2706](https://redirect.github.com/gin-gonic/gin/issues/2706). Close issue [#2682](https://redirect.github.com/gin-gonic/gin/issues/2682) [#2696](https://redirect.github.com/gin-gonic/gin/issues/2696). ### [`v1.7.1`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v171) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.7.0...v1.7.1) ##### BUG FIXES - fix: data race with trustedCIDRs from [#2674](https://redirect.github.com/gin-gonic/gin/issues/2674)([#2675](https://redirect.github.com/gin-gonic/gin/pull/2675)) ### [`v1.7.0`](https://redirect.github.com/gin-gonic/gin/blob/HEAD/CHANGELOG.md#Gin-v170) [Compare Source](https://redirect.github.com/gin-gonic/gin/compare/v1.6.3...v1.7.0) ##### BUG FIXES - fix compile error from [#2572](https://redirect.github.com/gin-gonic/gin/pull/2572) ([#2600](https://redirect.github.com/gin-gonic/gin/pull/2600)) - fix: print headers without Authorization header on broken pipe ([#2528](https://redirect.github.com/gin-gonic/gin/pull/2528)) - fix(tree): reassign fullpath when register new node ([#2366](https://redirect.github.com/gin-gonic/gin/pull/2366)) ##### ENHANCEMENTS - Support params and exact routes without creating conflicts ([#2663](https://redirect.github.com/gin-gonic/gin/pull/2663)) - chore: improve render string performance ([#2365](https://redirect.github.com/gin-gonic/gin/pull/2365)) - Sync route tree to httprouter latest code ([#2368](https://redirect.github.com/gin-gonic/gin/pull/2368)) - chore: rename getQueryCache/getFormCache to initQueryCache/initFormCa ([#2375](https://redirect.github.com/gin-gonic/gin/pull/2375)) - chore(performance): improve countParams ([#2378](https://redirect.github.com/gin-gonic/gin/pull/2378)) - Remove some functions that have the same effect as the bytes package ([#2387](https://redirect.github.com/gin-gonic/gin/pull/2387)) - update:SetMode function ([#2321](https://redirect.github.com/gin-gonic/gin/pull/2321)) - remove an unused type SecureJSONPrefix ([#2391](https://redirect.github.com/gin-gonic/gin/pull/2391)) - Add a redirect sample for POST method ([#2389](https://redirect.github.com/gin-gonic/gin/pull/2389)) - Add CustomRecovery builtin middleware ([#2322](https://redirect.github.com/gin-gonic/gin/pull/2322)) - binding: avoid 2038 problem on 32-bit architectures ([#2450](https://redirect.github.com/gin-gonic/gin/pull/2450)) - Prevent panic in Context.GetQuery() when there is no Request ([#2412](https://redirect.github.com/gin-gonic/gin/pull/2412)) - Add GetUint and GetUint64 method on gin.context ([#2487](https://redirect.github.com/gin-gonic/gin/pull/2487)) - update content-disposition header to MIME-style ([#2512](https://redirect.github.com/gin-gonic/gin/pull/2512)) - reduce allocs and improve the render `WriteString` ([#2508](https://redirect.github.com/gin-gonic/gin/pull/2508)) - implement ".Unwrap() error" on Error type ([#2525](https://redirect.github.com/gin-gonic/gin/pull/2525)) ([#2526](https://redirect.github.com/gin-gonic/gin/pull/2526)) - Allow bind with a map\[string]string ([#2484](https://redirect.github.com/gin-gonic/gin/pull/2484)) - chore: update tree ([#2371](https://redirect.github.com/gin-gonic/gin/pull/2371)) - Support binding for slice/array obj \[Rewrite] ([#2302](https://redirect.github.com/gin-gonic/gin/pull/2302)) - basic auth: fix timing oracle ([#2609](https://redirect.github.com/gin-gonic/gin/pull/2609)) - Add mixed param and non-param paths (port of httprouter[#329](https://redirect.github.com/gin-gonic/gin/pull/329)) ([#2663](https://redirect.github.com/gin-gonic/gin/pull/2663)) - feat(engine): add trustedproxies and remoteIP ([#2632](https://redirect.github.com/gin-gonic/gin/pull/2632))Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.